RHSA-2021:1734MediumCVSS 7.6

Red Hat Security Advisory: shim security update

Published
May 18, 2021
Last Modified
November 6, 2026

🔗 CVE IDs covered (7)

CVE-2020-25647 →CVE-2020-27749 →CVE-2020-27779 →CVE-2021-20225 →CVE-2021-20233 →CVE-2020-14372 →CVE-2020-25632 →

📋 Description

CVE-2020-14372 — grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled CVE-2020-25632 — grub2: Use-after-free in rmmod command CVE-2020-25647 — grub2: Out-of-bounds write in grub_usb_device_initialize() CVE-2020-27749 — grub2: Stack buffer overflow in grub_parser_split_cmdline() CVE-2020-27779 — grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled CVE-2021-20225 — grub2: Heap out-of-bounds write in short form option parser CVE-2021-20233 — grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

🎯 Affected products10

  • Red Hat CodeReady Linux Builder (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • shim-0:15.4-2.el8_1.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • shim-aa64-0:15.4-2.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • shim-ia32-0:15.4-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • shim-unsigned-aarch64-0:15-7.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)
  • shim-unsigned-aarch64-0:15-7.el8_1.src as a component of Red Hat CodeReady Linux Builder (v. 8)
  • shim-unsigned-x64-0:15.4-4.el8_1.src as a component of Red Hat CodeReady Linux Builder (v. 8)
  • shim-unsigned-x64-0:15.4-4.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)
  • shim-x64-0:15.4-2.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (12)